This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The privacy advocacy group noyb has filed a formal complaint against OpenAI with the Austrian data protection authority, alleging that ChatGPT violates GDPR requirements. The complaint centers on the model's tendency to hallucinate inaccurate personal data, such as birthdates, and the company's failure to provide mechanisms for users to correct or delete this information. This action highlights ongoing regulatory scrutiny in the EU regarding AI compliance with data privacy laws.
The activist organization noyb, founded by Max Schrems, filed a complaint in Europe against OpenAI alleging that ChatGPT violates the General Data Protection Regulation (GDPR) by providing inaccurate personal information such as birthdates about individuals.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that inadvertently generate or spread incorrect or deceptive information, which can lead to inaccurate beliefs in users and undermine their autonomy. Humans that make decisions based on false beliefs can experience physical, emotional or material harms
Also classified as
The complaint alleges violations of GDPR privacy rules regarding the processing, accuracy, and correction of personal data.
The system failed to perform reliably by hallucinating facts and failing to recognize its lack of correct data.
The incident involves ChatGPT generating incorrect and fabricated birthdates for an individual, which constitutes discrete false or misleading information.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk was caused by ChatGPT hallucinating incorrect personal data post-deployment, which is an unintentional technical failure of the model.
The privacy group noyb filed a GDPR complaint against OpenAI in Austria, alleging that ChatGPT hallucinated incorrect personal data and failed to provide correction mechanisms. While highlighting regulatory and privacy challenges for AI deployment in Europe, the incident has negligible national security implications.
The report describes ChatGPT as a chatbot that answers user requests and generates data about individuals, acting as an interactive assistant.
Risk Level 3. Limited Risk: The system is a chatbot (ChatGPT), which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations.
ChatGPT is primarily deployed as a conversational chatbot designed to answer user queries, including questions about individuals.
The report clearly details the specific complaint filed by noyb against OpenAI regarding ChatGPT's hallucination of Max Schrems' birthday. The legal basis (GDPR) and the technical failure (hallucination of personal data) are well-documented and unambiguous.
The incident could be viewed purely as a regulatory compliance issue rather than an AI safety failure, but the root cause is a technical limitation (hallucination) of the AI system.
Technology
Chatbot Hallucinations
LLMs generate plausible-sounding but false information like wrong birthdays.
Lack of Gap Detection
Chatbot does not inform users when it lacks the correct data to answer.
Data Inputs
Inaccurate Training Data
Lack of verified personal data sources leads to guessing personal details.
Human Factors
User Overreliance
Users trust chatbot outputs for factual personal data without verification.
Process and Methods
No Correction Mechanism
Lack of process to correct or delete inaccurate personal data in LLMs.
Inadequate Data Access Process
Failure to disclose processed data, sources, or recipients to individuals.
Management
Ignoring Regulatory Risk
Prioritizing deployment over establishing compliance with EU privacy laws.
Refusal to Address Complaints
Management refused to correct or delete wrong answers when requested.
Regulatory Environment
GDPR Compliance Gaps
AI systems struggle to meet EU requirements on accuracy and right to erasure.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
